CVE-2025-65473

Dec. 15, 2025, 7:28 p.m.

9.1
Critical

Description

An arbitrary file rename vulnerability in the /admin/filer.php component of EasyImages 2.0 v2.8.6 and below allows attackers with Administrator privileges to execute arbitrary code via injecting a crafted payload into an uploaded file name.

Product(s) Impacted

Vendor Product Versions
Easyimages2.0 Project
  • Easyimages2.0
  • *

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-73
External Control of File Name or Path
The product allows user input to control or influence paths or file names that are used in filesystem operations.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a easyimages2.0_project easyimages2.0 / / / / / / / /

References

https://congsec.cn?id=20251103235610-7t4en7j
https://gist.github.com/CongSec/107b9cab6dd1cb297a738f11e2b2dbb6

Tags

cve@mitre.org
2025-12-11
CVE-2025-65473

CVSS Score

9.1 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: HIGH
  • Scope: CHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: HIGH

    • CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

    View Vector String

Timeline

Published: Dec. 11, 2025, 5:15 p.m.
Last Modified: Dec. 15, 2025, 7:28 p.m.

Status : Analyzed

CVE has had analysis completed and all data associations made.

More info

Source

cve@mitre.org

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.